cyber.hendryadrian.com
Threat Research · darktrace.com

Safelink Smuggling Reuses Rewritten Links to Evade Email Security

· Original article ↗

Summary

Darktrace describes Safelink Smuggling, in which attackers get malicious links rewritten by email security services and reuse them in phishing or supply-chain attacks. It reports more than 300,000 suspicious cases over three months.

Key points

  • Attackers can obtain rewritten malicious links through a compromised account or by prompting an internal user to reply to an email containing a malicious link.
  • The rewritten link may appear trustworthy because it uses an established security provider’s domain, while redirects can conceal the eventual malicious destination.
  • Darktrace reported seeing more than 300,000 suspicious instances of Safelinks in unexpected contexts over three months.
  • Attackers can reuse the links in later emails, including with additional obfuscation such as QR codes; Darktrace describes a customer email it held before delivery.
  • The article says reuse of a security vendor’s rewritten links does not by itself indicate that the vendor’s infrastructure was compromised.
  • Recommended defenses include securing email accounts, using contextual email analysis, and making link rewriting more selective; Darktrace also recommends enabling link locks and warning pages for its customers.

Article Details

Attack Vectors
  • Safelink Smuggling: attackers submit malicious links for rewriting by email security solutions, then forward or otherwise propagate the rewritten links to other recipients.
  • A compromised email account may be used to submit a malicious link for rewriting and retrieve the rewritten URL from the resulting message.
  • In a reply-chain method, an attacker sends a malicious link to a customer and attempts to obtain the rewritten URL from an internal user's reply.
  • The article describes a caught example in which a smuggled Safelink was further obscured behind a QR code.
Defensive Notes
  • Use defense-in-depth to protect email accounts and monitor account activity.
  • Use email security that analyzes the context and content of messages and links rather than relying only on static threat intelligence, known patterns, or link reputation.
  • Email security providers should use selective link rewriting and ensure inbound analysis can detect Safelink Smuggling.
  • For Darktrace / EMAIL, the article recommends enabling lock links and displaying the default warning page whenever a link is rewritten.

MITRE ATT&CK

T1110 · Brute ForceThe article lists brute force as one possible way attackers may gain access to an account used in the compromised-account method.T1566.002 · Spearphishing LinkAttackers propagate malicious links to recipients through email, including links obscured by security rewriting.

Vendors

DarktraceDarktrace security members and researchers have recently seen a rise in what we are calling Safelink Smuggling. Safelinks are URLs rewritten by security solutions to enable additional analysis when the URL is clicked.

Products

Darktrace / EMAILConversely, Darktrace / EMAIL gathers sufficient information about a link without needing to rewrite it, by analyzing the context and content of the email and the link itself.Darktrace / IDENTITYbase account takeover protection offered by Darktrace / EMAIL, or the expanded defense offered by Darktrace / IDENTITY, it is crucial that the accounts themselves have a robust security solution in place.Darktrace Cyber AI AnalystIn the example below, you will see how Darktrace Cyber AI Analyst describes the example at hand under the Anomaly Indicators section.

Related Articles